RegistryViewer

RegistryViewer is a free registry forensic analysis tool that can open raw Windows NT 5 Registry files (Windows 2000 or higher). The file structure is showed similar to the Windows Registry editor. Folders, keys and values can be searched and the values can displayed in hexadecimal form.

The Registry files can be opened per Drag & Drop. All Registry files ("SYSTEM", "SOFTWARE", "SAM", "NTUSER.DAT", "SECURITY", "USERDIFF" and "DEFAULT") are supported.

RegistryViewer doesn't show the Registry files of the running operating system.

TIP:

To get information from the running system, you can use the application SystemReport. To read important and commonly needed information from Registry files, e.g. information about the operating system, the users and user activities, the recently connected hardware or the recently used files, you can use the RegistryReport application.